New VIRUS.GR virus report! Best on the net!


Recommended Posts

http://www.virus.gr/english/fullxml/default.asp?id=69&mnu=69

2-16 April 2005 (NEW!!!)

-The test was made on 02-16 April 2005, using Windows XP Professional SP1 on a P4 2600 Mhz, 512MB DDRAM.

-All programs tested had the latest versions, upgrades and updates and they were tested using their full scanning capabilities e.g. heuristics, full scan etc.

-The 91202 virus samples were chosen using VS2000 according to Kaspersky, F-Prot, RAV, Nod32, Dr.Web, Sweep, BitDefender and McAfee antivirus programs. Each virus sample was unique by virus name, meaning that AT LEAST 1 antivirus program detected it as a new virus.

-ALL virus samples were unpacked and the only samples that were kept were the ones that were packed using external-dos-packers (that means not winzip, winrar, winace etc).

-The virus samples had the correct file extension using a special program (Renexts) and were unique, according to checksum32 filesize.

-Most "fake" virus samples were removed, as well as "garbage" files.

-The program PER was not tested because there was no english demo version available.

-The programs Extendia AVK , BOClean , VET , Titan , RisingAV and Freedom were not tested because there was no demo version available.

-The program InVircible did not include a "typical" scanner-function and could not be tested.

-The program V-Catch checks only mail accounts and could not be tested.

-The following file types were used.

BAT, ΒΙΝ, CLA, CLASS, CLS, COM, CSC, DAT, DOC, ELF, EML, EXE, HLP, HQX, HTA, HTM, IMG, INF, INI, JS, MAC, MDB, MSG, OLE, PHP, PIF, PL, PPT, PRC, REG, SCR, SH, SHS, SMM, STI, TD0, TPU, VBA, VBS, WBT, XLS, XMI, XML.

The virus samples were divided into these categories, according to the type of the virus :

File = BeOS, FreeBSD, Linux, Palm, OS2, Unix, BinaryImage, BAS viruses, MenuetOS viruses.

MS-DOS = MS-DOS and HLL*. viruses.

Windows = Win.*.* viruses.

Macro = Macro and Formula viruses.

Malware = Adware, DoS, Constructors, Exploit, Flooders, Hoax, Jokes, Nukers, Sniffers, Spoofers, Virus Construction Tools, Virus Tools, Corrupted, Droppers, Intended, PolyEngines.

Script = BAT, Corel, HTML, Java, Scripts, VBS, WBS, Worms, PHP, Perl viruses.

Trojans-Backdoors = Trojan and Backdoor viruses.

Rank

1. Kaspersky Personal Pro version 5.0.20 - 99.28%

2. AVK version 15.0.5 - 97.93%

3. F-Secure 2005 version 5.10.450 - 97.55%

4. eScan Virus Control version 2.6.518.8 - 96.75%

5. Norton Corporate version 9.0.3.1000 - 91.64%

6. Norton Professional version 2005 - 91.57%

7. McAfee version 9.0.10 - 89.75%

8. Virus Chaser version 5.0 - 88.31%

9. BitDefender version 8.0.137 - 88.13%

10. CyberScrub version 1.0 - 87.87%

11. Panda Platinum 2005 version 9.01.02 - 87.75%

12. Arcavir - 87.73%

13. MKS_VIR 2005 - 87.70%

14. RAV version 8.6.105 - 87.26%

15. F-Prot version 3.16b - 87.07%

16. Panda Titanium version 4.01.02 - 86.27%

17. PC-Cillin 2005 version 12.1.1034 - 85.98%

18. Nod32 version 2.12.4 - 85.66%

19. Command version 4.92.7 - 84.92%

20. AntiVir version 6.30.00.17 - 84.50%

21. Avast version 4.6.623 - 76.65%

22. Dr. Web version 4.32b - 78.71%

23. Sophos Sweep version 3.91 - 73.79%

24. UNA version 1.83 - 73.49%

25. BullGuard version 4.5 - 70.24%

26. Norman version 5.80.05 - 65.32%

27. Ikarus version 5.16 - 60.97%

28. AVG version 7.0.308 - 54.07%

29. E-Trust version 7.0.5.3 - 52.35%

30. ZoneAlarm with VET Antivirus version 5.5.062.011 - 52.32%

31. Vexira 2005 version 5.0.56 - 51.74%

32. VirusBuster 2005 version 5.0.147 - 51.51%

33. Solo 3.0 version 2.7.1 - 49.16%

34. Fire version 2.7 - 48.86%

35. ClamWin version 0.83 - 48.44%

36. Digital Patrol version 5.00.08 - 48.10%

37. V-Buster Pro - 46.33%

38. Protector Plus version 7.2.G01 - 45.81%

39. V3Pro 2004 - 38.87%

40. Ewido version 3.0 - 38.67%

41. ViRobot Expert version 4.0 - 38.10%

42. Quick Heal version 7.03 - 37.75%

43. VirScan Plus version 14.703 - 36.20%

44. MR2S version 2.0.104 - 35.05%

45. RHBVS version 4.60.821 - 32.96%

46. A Squared 2 version 1.6 - 25.37%

47. VirIT version 5.2.10 - 22.83%

48. TDS version 3.2.0 - 21.09%

49. Wave version 2.0 - 16.49%

50. AntiTrojan Shield version 1.4.0.15 - 11.91%

51. PC Door Guard version 3.0.0.15- 11.91%

52. Trojan Hunter version 4.2.908 - 10.19%

53. Tauscan version 1.70.1414 - 6.99%

54. Trojan Remover version 6.3.6 - 6.67%

55. The Cleaner version 4.1.42.52 - 6.28%

56. IP Armor version 5.46.0703 - 2.77%

57. Hacker Eliminator version 1.2 - 2.67%

58. Anti-Hacker & Trojan Expert 2003 version 1.6 - 0%

DETAIL TEST RESULTS (.rar compressed file)

I just personally decided to try NOD32 this past week since so many people say they like it. It's nice, but it does *not* have the best detection rate ever. I tested it against a collection of virii and it missed many small-time viruses that competitors found.

http://www.wilderssecurity.com/showthread.php?t=77033

I wouldn't take much notice of these tests.

How comes at least two of the products that utilise the same engine are so wildly different in detection rate?

I have no doubt KAV is very likely to be one of the best AV products, but that is probably the only truth I can see in those tests. I'm not even going to ask why anti-trojan products are considered anti viral. :p

I just personally decided to try NOD32 this past week since so many people say they like it.  It's nice, but it does *not* have the best detection rate ever.  I tested it against a collection of virii and it missed many small-time viruses that competitors found.

585822593[/snapback]

Were they actual viruses, or test viruses? NOD32 does not detect fake viruses and WILL NOT detect them at all (this is by design) - that is why some reviews give it a bad score.

I would imagine the score for NOD32 is not great because of fake viruses (it only say "most" were removed) and/or not detecting adware.

Were they actual viruses, or test viruses? NOD32 does not detect fake viruses and WILL NOT detect them at all (this is by design) - that is why some reviews give it a bad score.

I would imagine the score for NOD32 is not great because of fake viruses (it only say "most" were removed) and/or not detecting adware.

585822659[/snapback]

They were actual viruses I collected "in the wild" so to speak. The heuristics engine detected a great number of them which is a plus, but when you put the complete misses together with the number of heuristics hits, it seemed clear that the actual detection database itself was rather lacking.

I think the reason that the detection database is less as if an AV supplier were to add every virus to its database, the intensity of the resource demands of the product would be extremelly high. It is usually up to those behind the product to choose the severity of the threats. With NOD32, I see the heuristics as the first line defence with rules aiding as a backup.

One interesting thing brought up in the Wilder's thread was if all of the AVs were licensed or trialed. I know with NOD, a lot of the default settings are insufficient. I am not even sure heuristics are enabled off-the-shelf. A lot of other products do have limited availability in trial/shareware items, for example: ewido paid can scan inside of archives while the free solution cannot.

I am not greatly surprised with the results, a lot of the test samples were malware/trojans, while IMO, it does usually take seperate products to provide greater protection in specialised areas (AVs for virus, ATs for trojans, etc). I would however, be interested in seeing the test categorised more so with anti-trojans being used solely on virus, solely on malware or a similar structured approach.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • You've tried DuckDuckGo and Brave Search, now get serious with SearXNG by Paul Hill Over the last decade, it has become quite trendy to dump Google Search in favor of privacy-preserving alternatives such as DuckDuckGo, Startpage, and Brave Search. These search engines have done a very good job at highlighting dodgy practices by Google, such as adjusting search results based on what it thinks you’ll like (filter bubble) and stalking you around the web to advertise to you. While these search engines are good starting points when compared to non-private services like Google, there are still quite a few issues with them. For example, both DuckDuckGo and Brave Search require running non-free JavaScript in your web browser, which is comparable to running proprietary software on your computer, meaning you can be sure about what it’s actually doing in the background. Another issue is that these search engines are hosted on the respective companies’ servers, and you are using a service that you don’t control. Finally, DuckDuckGo, while offering privacy features, relies heavily on Microsoft’s infrastructure for its results and, in the past, has permitted Microsoft tracking scripts. If you are looking for a more private search solution than DuckDuckGo, Brave Search, and Startpage, then I recommend taking a look at SearXNG. It is a privacy-respecting metasearch engine that can be used via different public instances, which is useful for mobile users, or you can install it on your computer or server and run it locally with maximum control. Unlike Google, Bing, or Brave Search, which crawl the web and have their own search indexes, SearXNG is a metasearch engine, meaning it taps other search engines, stripping your identifying data, such as IP address, user agent, and cookies, in the process. Your search query is sent to the other search engines you enable before aggregating the results. SearXNG has deployment flexibility. If you are a casual user or a mobile user and don’t want to run SearXNG locally, you can use a public instance that is hosted by someone else. The main problem with this is that you are putting trust in the maintainer of the instance regarding stuff like logs that they may keep; good hosts should have a privacy policy explaining their policies. If you are trying to use SearXNG, you can also install the software on your device and then head to 127.0.0.1:8080 in your browser and search from there. While you don’t have to worry about a third-party admin like the public instances, search engines could ultimately block your IP address if they frown on you pulling in their search results locally. If you want to run it locally, it’s a good idea to use proxies or VPNs to hide your actual IP. You don’t have to worry about this with a public instance, as search engines never see your IP address. The main privacy benefit of using SearXNG is that it isolates your identity from the underlying engines that it’s capable of searching, such as Google and Bing. These search engines will only see requests coming from a generic server, so they can’t profile you and create a bubble filter that influences what results you see. This also ensures that your search engine doesn’t turn into an echo chamber that prevents you from reading alternative points of view. As a free software project, you are allowed to inspect SearXNG to make sure there are no negative features bundled inside. This sets it apart from the privacy search engines mentioned earlier because you can’t check their source code. As a meta search engine, you are not restricted to getting results from one source. Due to the fact that it scrapes content from other websites, your SearXNG instance will periodically get blocked from different providers, so it’s good to select a range of sources as a backup. While enabling all of the services will give you great results, this can make searching slower. I am personally happy with slower searches for the best results, but you can always check which providers are slowing down your search from the search results page and disable them to speed things up. If you want decent results quickly, enable the main search providers such as Google, Brave, DuckDuckGo, Qwant, Bing, and Yahoo. This way, you get wide coverage without the latency. On the Engines tab in Preferences, do note that there are different tabs, such as General, Images, and Videos, with their own providers that can be toggled and are not covered by "Enable all" while on the General tab, so be sure to dig into each. Just a note, if you want to enable everything, press "Enable all" in one tab, then hit save at the bottom of the page, then do the next tab, and so on. If you press "Enable all", then do that in each tab, and then save, nothing will stick. When I had just some of the search engines enabled, I searched “define nefarious” and results came back with the definition of “define” - obviously that was a sucky result. However, when I had everything enabled, it found dictionary pages for the word “nefarious” and even had an inline definition on the sidebar, which is quite nice too - that was delivered by WolframAlpha for anyone wondering! Probably the worst thing about this meta search engine is that the engines you select are saved with a cookie, so you must enable them on every new device you use SearXNG on, including if you decide to go into incognito mode with your web browser. Honestly, I would say this is the most annoying aspect, and perhaps if your browser lets you choose a separate private browsing search engine, then it would be best to use DuckDuckGo for this portion of your browsing. Another weakness of SearXNG is the random blocking of it by search providers. When you are on the results page, expand the “Response time” box, and it will show things like “Suspended: too many requests” or “access denied”. This is why it is good to enable several providers so that there is always a fallback to get results from. I won’t pretend SearXNG will be for everyone, however, if you enable all of the providers and put up with the slower response time, the results can be really amazing. Even if you don’t want to use it as your daily driver, keeping a bookmark handy that links to it is a good idea if you ever feel like doing a deep dive into a niche topic where other search engines are just failing to bring up any good result, due to the amount of sources it looks on. If you’re interested in radical user control over the software you use, installing SearXNG locally can also be a good idea, but be prepared to be temporarily blocked from sites if you trigger bot sensors without a VPN. Personally, I’ve opted to use a public instance, rather than install it myself. If you want to use it via a public instance, head over to searx.space to find a provider. Let us know in the comments if you have used SearXNG or its predecessor, Searx. What do you think about the quality of the results?
    • Dear Neowin, If it is not too much trouble, can you start using the new-ish designations for Insider Preview? "Experimental" is different than "former Dev" as it can apply to different models, eg 26H1 or 26H2 etc, right? No need to seed confusion IMHO. And, please "finally" update your graphics. OK?
    • Did you see their FAQ, its quite good. Have a look in the Advanced section. https://delta.chat/en/help
    • Just install Linux Mint that is a real blessing and many times cheaper because you can continue using your old Windows computer/laptop with the latest Linux updates.
    • Interesting share -- however it does not make sense: Email messages get stored somewhere, so how is Delta Chat "based on email" and decentralized without actually storing anything? By Web3 standard practices, the various Relays would require dedicated storage to make messages available to the recipients (like a large series of message queue channels, akin to racks of traditional post office boxes)... and Contacts must be two-way confirmed in order for encryption keys to be exchanged (ostensibly every key-pair is uniquely bound between sender and recipient) and the Relays would preserve the public keys in order to facilitate message carriage... or every device stores all sorts of keys and contact info. All of this to say, decentralized messaging is like running Bluesky nodes except instead of discovering/browsing public feeds by various posters (at the given node) these Delta Chats would be relaying encrypted messages (via Relays) that only trusted recipients would have the appropriate decryption key (their own private key) to read it. But this doesn't solve the "it's like email" sales pitch. The only way it's like email is that there's encrypted binary stuff being transported from your app into the federated ether of Delta Chat Relays for others to decrypt (hopefully only the intended recipient)... but outside of this federated relays framework, it is absolutely nothing like email.
  • Recent Achievements

    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
    • Week One Done
      tuben earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      503
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      158
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!